CVE-2007-2120: Oracle Application Server

High severity, CVSS 7.8. EPSS: 3% chance of exploitation in the next 30 days.

The Oracle Discoverer servlet in Oracle Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2.0 allows remote attackers to shut down an Oracle TNS Listener via a TNS STOP command in a request that uses the database/TNS alias, aka AS01.

Affected products

• Oracle Application Server: version 9.0.4.3 only; version 10.1.2.0.2 only; version 10.1.2.2 only

Published 2007-04-18. Last modified 2026-06-16.